Anonymous collection of directional transmissions

ABSTRACT

A method for communication includes detecting, at a first station in a wireless network, a beacon transmitted over the wireless network by a second station having multiple antennas. In response to the beacon, a request-to-send (RTS) frame is transmitted over the wireless network using a multi-carrier modulation scheme from the first station to the second station. The first station receives a clear-to-send (CTS) frame transmitted over the wireless network, in response to the RTS frame, by the second station via the multiple antennas using the multi-carrier modulation scheme, and estimates a property of the first station based on the received CTS frame.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation in part of PCT Patent ApplicationPCT/IB2020/060801, filed Nov. 17, 2020, which claims priority from U.S.patent application Ser. No. 16/783,196, filed Feb. 6, 2020 (now U.S.Pat. No. 11,240,846). Both of these related applications areincorporated herein by reference.

FIELD OF THE INVENTION

The present invention relates generally to wireless communicationsystems, and particularly to methods for localization based on wirelessnetwork signals.

BACKGROUND

Various techniques are known in the art for finding the location of amobile wireless transceiver, such as a cellular telephone. For example,nearly all cellular telephones now have a Global Positioning System(GPS) receiver, which derives location coordinates from signals receivedfrom geostationary satellites. Because of its dependence on weaksatellite signals, however, GPS works poorly, if at all, indoors and incrowded urban environments. Cellular networks are also capable oftriangulating telephone location based on signals received ortransmitted between the cellular telephone and multiple cellularantennas, but this technique is inaccurate and unreliable.

A number of methods have been proposed for indoor localization based onan existing wireless local area network (WLAN) infrastructure. One suchapproach is described, for example, by Kotaru et al., in “SpotFi:Decimeter Level Localization using WiFi,” published in SIGCOMM '15(London, UK, Aug. 17-21, 2015). According to the authors, SpotFicomputes the angle of arrival (AoA) of multipath components receivedfrom access points, and uses filtering and estimation techniques toidentify the AoA of a direct path between the localization target andthe access point.

As another example, U.S. Patent Application Publication 2009/0243932describes a method for determining the location of a mobile device. Themethod comprises transmitting a signal between a plurality of knownlocations and receiving the signal at a device of unknown location, suchas a mobile device. The signal may include multiple tones havingdifferent frequencies and resulting in sets of residual phasedifferences. The location of the mobile device may be determined usingthe known locations and the frequency and phase differences between thetransmitted tones. In one embodiment, orthogonal frequency-divisionmultiplexing (OFDM) signals may be used between an access point andmobile device to determine the location of the mobile device.

U.S. Pat. No. 9,814,051, whose disclosure is incorporated herein byreference, describes a method for signal processing, which includesreceiving at a given location at least first and second signalstransmitted respectively from at least first and second antennas of awireless transmitter. The at least first and second signals encodeidentical data using a multi-carrier encoding scheme with a predefinedcyclic delay between the transmitted signals. The received first andsecond signals are processed, using the cyclic delay, in order to derivea measure of a phase delay between the first and second signals. Basedon the measure of the phase delay, an angle of departure of the firstand second signals from the wireless access point to the given locationis estimated.

The RTS/CTS (request to send/clear to send) mechanism is used in WLANsfor the purpose of carrier sensing and collision avoidance, inaccordance with the IEEE 802.11 medium access control (MAC) standard.Stations in a WLAN maintain a network allocation vector (NAV) toindicate the time during which the wireless medium is considered to bebusy, and update the NAV using the RTS/CTS mechanism, as described, forexample, in section 9.3.2.4 of the IEEE 802.11-2012 standard. Anoriginating station transmits an RTS frame over the WLAN, with areceiver address (RA) indicating the MAC address of the station to whichthe frame is directed and a transmitter address (TA) indicating the MACaddress of the station transmitting the frame. Upon receiving the RTSframe, the receiving station transmits a CTS frame, in which the RA isset to the TA value of the RTS frame. Stations that receive the RTS orCTS frame update their NAV settings and refrain from transmission for aperiod indicated by the NAV value. During this period, the originatingstation is able to transmit one or more data frames over the WLANwithout contention.

U.S. Pat. No. 8,504,063 describes a method and system in which a firstdevice may directionally transmit signals to a second device utilizingbeamforming operations on multiple antennas. The first device mayreceive signals from the second device to establish an anonymousdirectional peer-to-peer wireless communication link with the seconddevice. The transmitted signals may comprise a request-to-send (RTS)signal and the received signals may comprise a clear-to-send (CTS)signal. The transmitted signals may comprise an associationidentification (ID) corresponding to the first device, which may beembedded in a preamble or other portion of a frame structure. When thelink is established, user information, such as profile information, forexample, and/or messages may be sent from one device to the other.

SUMMARY

Embodiments of the present invention that are described hereinbelowprovide improved methods and systems for location finding.

There is therefore provided, in accordance with an embodiment of theinvention, a method for communication, which includes detecting, at afirst station in a wireless network, a beacon transmitted over thewireless network by a second station having multiple antennas. Inresponse to the beacon, a request-to-send (RTS) frame is transmittedover the wireless network using a multi-carrier modulation scheme fromthe first station to the second station. The first station receives aclear-to-send (CTS) frame transmitted over the wireless network, inresponse to the RTS frame, by the second station via the multipleantennas using the multi-carrier modulation scheme. An angle oftransmission from the second station to the first station is estimatedbased on the received CTS frame.

There is further provided, in accordance with an embodiment of theinvention, a method for communication, which includes detecting, at afirst station in a wireless network, a beacon transmitted over thewireless network by a second station having multiple antennas. Inresponse to the beacon, a request-to-send (RTS) frame is transmittedover the wireless network using a multi-carrier modulation scheme fromthe first station to the second station. The first station receives aclear-to-send (CTS) frame transmitted over the wireless network, inresponse to the RTS frame, by the second station via the multipleantennas using the multi-carrier modulation scheme. A property of thefirst station is estimated based on the received CTS frame.

In the disclosed embodiments, detecting the beacon includes identifying,at the first station, a signal transmitted by the second station using asingle-carrier modulation scheme as the beacon. In one embodiment, thesingle-carrier modulation scheme is a complementary code keying (CCK)scheme, while the multi-carrier modulation scheme is an orthogonalfrequency-division multiplexing (OFDM) scheme.

In some embodiments, detecting the beacon includes extracting a mediumaccess control (MAC) address of the second station from the beacon, andtransmitting the RTS frame includes inserting the MAC address as areceiver address (RA) in the RTS frame. In a disclosed embodiment,transmitting the RTS frame includes generating a spoofed address thatencodes the MAC address of the second station, and inserting the spoofedaddress as a transmitter address (TA) in the RTS frame, thereby causingthe second station to insert the spoofed address as the RA in the CTSframe. Receiving the CTS frame then includes decoding the RA of the CTSframe in order to identify the second station as having transmitted theCTS frame. In one embodiment, the second station includes an accesspoint (AP) in the wireless network, and the MAC address of the secondstation includes a basic service set identifier (BSSID) of the AP.

Typically, after receiving the CTS frame, the first station does nottransmit further frames to the second station for at least 100 ms.

In a disclosed embodiment, receiving the CTS frame includes receivingmultiple signals transmitted respectively from the multiple antennas ofthe second station with a predefined cyclic delay between the multiplesignals, and estimating the angle of departure includes measuring aphase delay between the multiple signals using the cyclic delay, andfinding the angle of departure using the measured phase delay.

In some embodiments, the first station is a mobile station in a wirelesslocal area network (WLAN), and the second station is a stationary accesspoint (AP) in the WLAN. In one embodiment, the method includes findinglocation coordinates of the mobile station by estimating respectiveangles of departure from a plurality of APs to the mobile station.Additionally or alternatively, transmitting the RTS frame and receivingthe CTS frame include transmitting and receiving the RTS and CTS framesto and from the AP without establishing an association between themobile station and the AP.

In one embodiment, the method includes receiving the CTS frame from thesecond station at a third station, which did not transmit the RTS frame,and estimating an angle of transmission from the second station to thethird station or a further property of the third station based on thereceived CTS frame.

In some embodiments, estimating the property includes processing thereceived CTS frame to extract channel state information (CSI), andcomputing a value of the property of the first station using theextracted CSI. In one embodiment, computing the value includes finding alocation of the first station. Additionally or alternatively, computingthe value includes finding a velocity of the first station. Furtheradditionally or alternatively, computing the value includes detecting aperiodic variation in the CSI, and applying the periodic variation inassessing periodic changes in an environment of the first station.

In some embodiments, transmitting the RTS frame includes transmitting asequence of RTS frames in response to a motion of the first station. Ina disclosed embodiment, transmitting the sequence includes setting arate of repetition of the RTS frames responsively to a speed of themotion. The purpose of the repetition of the RTS frames is to receive acorresponding repetition of CTS frames, as input data.

There is also provided, in accordance with an embodiment of theinvention, apparatus for communication, including a transceiver, whichis configured to detect a beacon transmitted over a wireless network bya station having multiple antennas. A processor is configured to drivethe transceiver, in response to the beacon, to transmit arequest-to-send (RTS) frame over the wireless network using amulti-carrier modulation scheme to the station, and to process aclear-to-send (CTS) frame transmitted over the wireless network, inresponse to the RTS frame, by the station via the multiple antennasusing the multi-carrier modulation scheme and received by thetransceiver, in order to estimate a property, such as an angle ofdeparture from the station to the apparatus.

There is additionally provided, in accordance with an embodiment of theinvention, a computer software product, including a non-transitorycomputer-readable medium in which program instructions are stored, whichinstructions, when read by a processor, cause the processor to detect abeacon transmitted over a wireless network by a station having multipleantennas, and to transmit, in response to the beacon, a request-to-send(RTS) frame over the wireless network using a multi-carrier modulationscheme to the station, and to receive and process a clear-to-send (CTS)frame transmitted over the wireless network, in response to the RTSframe, via the multiple antennas using the multi-carrier modulationscheme in order to estimate an angle of departure from the station.

There is moreover provided, in accordance with an embodiment of theinvention, a computer software product, including a non-transitorycomputer-readable medium in which program instructions are stored, whichinstructions, when read by a processor, cause the processor to detect abeacon transmitted over a wireless network by a second station havingmultiple antennas and received by a first station, and to transmit fromthe first station, in response to the beacon, a request-to-send (RTS)frame over the wireless network using a multi-carrier modulation schemeto the second station, and to receive and process a clear-to-send (CTS)frame transmitted over the wireless network, in response to the RTSframe, via the multiple antennas using the multi-carrier modulationscheme in order to estimate a property of the first station.

The present invention will be more fully understood from the followingdetailed description of the embodiments thereof, taken together with thedrawings in which:

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is schematic, pictorial illustration of a system for wirelesslocation finding, in accordance with an embodiment of the invention;

FIG. 2 is a diagram that schematically illustrates a coordinate frameused in deriving an angle of departure of wireless signals from atransmitter to a receiver, in accordance with an embodiment of theinvention;

FIG. 3 is a schematic, pictorial illustration of components of thesystem of FIG. 1, illustrating a method for finding the location of amobile communication device, in accordance with an embodiment of theinvention; and

FIG. 4 is a flow chart that schematically illustrates a method foranonymous collection of directional transmissions, in accordance with anembodiment of the invention.

DETAILED DESCRIPTION OF EMBODIMENTS Overview

In a WLAN that operates in accordance with IEEE 802.11 standards, accesspoints (APs) transmit beacon frames (commonly referred to simply as“beacons”) periodically in order to announce their presence andsynchronize members of their service set. The beacon includes the basicservice set identifier (BSSID) of the transmitting AP and containsinformation regarding the capabilities of the AP.

In advanced members of the IEEE 802.11 family of standards, such as IEEE802.11n, APs transmit downlink signals, including beacons, via multipleantennas using a multi-carrier modulation scheme (specifically OFDM).The AP introduces a predefined cyclic delay between the respectivesignals that are transmitted by the different antennas. Theabove-mentioned U.S. Pat. No. 9,814,051 explains how this cyclic delaycan be used by a receiver in estimating the phase delay between thesignals from the different antennas, and how the receiver can use thisphase delay in finding the angle of departure of the signals from the APto the receiver (for example in col. 13, line 11- col 18, line 45).These estimation techniques can also be applied to multi-antenna OFDMbeacons (as noted in col. 15, lines 1-18). One advantage of thisapproach is that it enables even a mobile station with only a singleantenna to find angles of departure from APs to the mobile stationwithout requiring the mobile station to establish an association withthe BSSID of any of the APs.

Earlier members of the IEEE 802.11 family, however, such as IEEE802.11b, did not support OFDM or multi-antenna transmission. Inaccordance with IEEE 802.11b, APs transmit beacons in a band at around2.4 GHz using a single-carrier modulation scheme: complementary codekeying (CCK). To maintain backward-compatibility with legacy stations,many APs with more advanced capabilities, such as IEEE 802.11g and IEEE802.11n, still transmit beacons in this manner The beacons are typicallytransmitted omnidirectionally, from a single antenna among the multipleantennas of the AP. Therefore, these beacons do not provide mobilestations with the phase information that is needed in order to find theangle of departure from the AP to the mobile station.

After a mobile station with 802.11g or 802.11n capabilities associateswith the AP, the AP will transmit OFDM signals via its multiple antennasto the mobile station. (APs operating in accordance with IEEE 802.11nmay transmit multi-antenna signals in either the 2.4 GHz band or in aband at around 5 GHz; 802.11n APs that operate in the 2.4 GHz band aresometimes referred to as “802.11ng” APs.) This association process istime-consuming, however, and requires the mobile station to presentcredentials, which the mobile station may not have. Applications such asthose described in the above-mentioned U.S. Pat. No. 9,814,051, in whichthe mobile station finds its location by estimating angles of departurefrom multiple different APs, need a faster way to prompt APs, such as802.11ng APs, to begin transmitting multi-antenna OFDM signals. Thisneed is particularly acute when the mobile station is moving, forexample in a moving vehicle.

Embodiments of the present invention that are described herein addressthis need by providing techniques that can be used by a mobile stationin inducing APs to transmit multi-carrier signals via their multipleantennas, without requiring any sort of association between the mobilestation and the APs. These techniques take advantage of the RTS/CTSmechanism that is described above. This mechanism is commonlyimplemented in hardware logic of the AP and is independent of any sortof association between the stations in the WLAN. It can thus be carriedout quickly, between the mobile station and multiple different accesspoints in turn.

In fact, the 802.11 standard requires the recipient of an RTS frame torespond within tight time limits. For this reason, the RTS/CTS mechanismis typically implemented by APs in hardware logic and does not involveany sort of authentication of the TA of the RTS frame. Some embodimentsof the present invention take advantage of this feature, as well, inspoofing the of TA to encode the MAC address of the AP to which the RTSframe is directed, as explained below.

RTS/CTS is normally used for purposes of collision avoidance, and isfollowed immediately thereafter by transmission of one or more dataframes by the station that transmitted the RTS frame. In the some of theembodiments that are described herein, however, the station transmittingthe RTS frame uses the CTS frame that it then receives as a source ofdirectional information, and typically does not transmit any furtherframes to the station to which the RTS frame was transmitted for aperiod of at least 100 ms, if not longer.

The novel applications of the RTS/CTS mechanism that are provided byembodiments of the present invention are particularly useful in findingproperties of the mobile station based on the multi-carrier CTS frame.For example, the CTS frame may be processed to compute angles ofdeparture from APs to a given mobile station. Alternatively oradditionally, the mobile station may process the CTS frame to extractchannel state information (CSI), and may then compute values ofproperties such as the location and velocity of the mobile station usingthe extracted CSI, even without finding the angle of departure. Furtheralternatively or additionally, the principles of the present inventionmay be applied in finding angles and directions between stations usingother multi-antenna direction-finding techniques, not only betweenstations in an 802.11 WLAN, but also in other sorts in wirelessnetworks.

In the particular embodiments that are described below, a first stationin a wireless network, such as a mobile station in a WLAN, detects abeacon transmitted over the wireless network by a second station havingmultiple antennas, such as an AP. The beacon is transmitted using asingle-carrier modulation scheme, such as CCK, as explained above. Inresponse to the beacon, the first station transmits an RTS frame using amulti-carrier modulation scheme, such as OFDM, to the second station. Inresponse to the RTS frame, the second station transmits a CTS frame viaits multiple antennas using the multi-carrier modulation scheme. One ormore properties of the first station can then be estimated based on thereceived multi-carrier CTS frame. In one embodiment, the estimatedproperties include the angle of transmission, for example the angle ofdeparture, from the second station to the first station. Additionally oralternatively, the first station processes the received multi-carrierCTS frame to extract channel state information (CSI), and values of oneor more properties of the first station, such as location and/orvelocity of the first station, are computed using the extracted CSI.

This approach has the additional advantage of being able to servemultiple location-finding mobile stations in the proximity of an APsimultaneously. In this sort of situation, one mobile station will sendan RTS frame, which will cause the remaining mobile stations to refrainfrom sending their own RTS frames. Most or all of these mobile stationswill receive the CTS frame from the AP and will thus be able to findtheir own channel state information and angles of departure from the AP.

SYSTEM DESCRIPTION

FIG. 1 is schematic, pictorial illustration of a system 20 for wirelesscommunications and position finding, in accordance with an embodiment ofthe invention. By way of example, FIG. 1 shows a typical environment,such as a shopping mall or street, in which multiple access points 22,24, 26, . . . , are deployed, often by different WLAN proprietorsindependently of one another. (The notation “. . . ” is used inenumerating items of a given type in the present description to indicatethat the pictured instances of the given type of item may be part of alarger group of such items.) Signals transmitted by the access pointsare received by receivers in the form of mobile stations 28, 30, . . . ,which are operated by users 32 who are free to move around within thearea covered by system 20. In the pictured embodiment, stations 28, 30,. . . , are shown as smartphones; but other sorts of mobiletransceivers, such as laptop and tablets computers, as well as dedicatedradio tags, may be used in similar fashion and can similarly find anglesfrom departure of access points 22, 24, 26, . . . , as describedhereinbelow.

Each of access points 22, 24, 26, . . . , in system 20 is assumed tohave two or three antennas 34, as shown in FIG. 1. The principles of thepresent invention are similarly applicable to fixed transceivers havingeven greater numbers of antennas. Mobile stations 28, 30, . . . , areeach assumed to have a single, omnidirectional antenna 36, which isconnected to a radio transceiver 37; but the techniques described hereinfor detecting angles can similarly be implemented by multi-antennastations. Transceiver 37 typically comprises suitable analog and digitalinterface circuits, as are known in the art, including physical layer(PHY) and MAC interfaces.

Each of mobile stations 28, 30, . . . , comprises a respective processor39, which processes signals received by antenna 36 from antennas 34 inorder to estimate properties such as channel state information (CSI) andangles of departure of the signals from the respective access points 22,24, 26, . . . , as well as to extract an identifier (such as the BSSID)with regard to each access point. The angles of departure may becomputed in two dimensions, assuming the access points and mobilestations to be in proximity to a common plane, or in a three-dimensionalcoordinate system. These angles of departure are used in finding theangles of orientation between the access points and the mobile stationsin the coordinate frame of the access points (marked a in FIG. 1). Themobile stations are able to perform these functions, as describedfurther hereinbelow, without necessarily associating with the accesspoints.

Processor 39 typically comprises an embedded, multi-purposemicroprocessor or microcontroller, which performs the functionsdescribed herein under the control of suitable software, while invokingthe appropriate hardware-based functions of transceiver 37. Thissoftware may be stored on tangible, non-transitory computer-readablemedia, such as optical, magnetic or electronic memory media.Alternatively or additionally, at least some of the functions ofprocessor 39 may be implemented in programmable or hard-wired logic.Typically, processors 39 also perform other computing and controlfunctions within mobile stations 28, 30, . . . , but these functions arebeyond the scope of the present invention.

In the present embodiment, one or more of access points 22, 24, 26, . .. , transmit beacons in accordance with a legacy protocol. For example,as noted earlier, an 802.11g or 802.11ng access point may transmitbeacons compatible with IEEE 802.11b, which mandates that the beacons betransmitted using CCK over a single carrier in the 2.4 GHz band. Thebeacons provide the BSSID of the transmitting access point. Uponreceiving such a beacon, a mobile station, such as mobile station 28,will initiate an RTS/CTS exchange with the access point. The mobilestation transmits the RTS frame in the exchange using OFDM signals. Thisexchange induces the access point to transmit OFDM signals in the sameband as the RTS frame, from which properties such as CSI and angle ofdeparture can be found without necessarily creating an associationbetween the mobile station and the access point. This functionality isdescribed further hereinbelow with reference to FIG. 4.

At the same time, mobile stations 28, 30, . . . , may associate with oneor more of access points 22, 24, 26, . . . , for purposes of Internetcommunications. Alternatively or additionally, the mobile stations mayaccess the Internet via a cellular network or other connection. In anycase, mobile stations 28, 30, . . . , communicate the angle-of-departuredata and access point identification that they collect via a network 38to a mapping server 40. This information may be collected and reportedautonomously and automatically by a suitable application program (“app”)running in the background on processor 39 in the mobile stations. Server40 may process the data provided by the mobile stations in order to findrespective location coordinates of the mobile stations, for example bytriangulation, as described in the above-mentioned U.S. Pat. No.9,814,051.

Server 40 typically comprises a general-purpose computer, comprising aprogrammable processor 42 and a memory 44. The functions of server 40that are described herein are typically implemented in software runningon processor 42, which may be stored on tangible, non-transitorycomputer-readable media, such as optical, magnetic or electronic memorymedia.

FIG. 2 is a diagram that schematically illustrates a coordinate frameused in deriving an angle of wireless signals transmitted between accesspoint 24 and mobile station 28, in accordance with an embodiment of theinvention. This particular pair of an access point and a mobile stationis selected purely for convenience, and similar principles will apply toany given pair. Although access point 24 is shown as having two antennas34 (labeled Tx1 and Tx2), the same geometrical principles apply toaccess points having three or more antennas arranged in a linear array.

Antennas 34 define an array axis as the line passing through the basesof the antennas. The antennas are separated along the array axis by aknown inter-antenna distance d. (The array axis is the line runningthrough antennas 34—shown as a vertical dashed line in FIG. 2.) Inwireless access points, for example, the distance d is designed to be ahalf wavelength, for example, λ/2=6.25 cm at the standard WLANtransmission frequency of 2.4 GHz, wherein λ is the wavelength of theradio signals. The angle of departure θ of the signals from antennas 34to antenna 36 of mobile station 28 is taken relative to the normal tothe array axis, as shown in FIG. 2. Assuming the distance from accesspoint 24 to mobile station 28 to be considerably greater than d, therewill be a difference of d*sinθ in the path length from Tx1 to antenna 36(referred to as Rx) relative to the path length from Tx2.

As an example, assuming the length of the path from Tx2 to Rx is 6.0000m, θ=30°, the slightly longer path from Tx1 to Rx will be 6.03125 m.This path difference translates into a 90° phase difference: Δφ=dsin(π/6)=λ/2*λ/4. The phase difference varies with angle, as well aswith the wavelength (or frequency) of transmission. When access point 24transmits OFDM signals in accordance with the IEEE 802.11n standard, forexample, processor 39 in mobile station 28 can measure the phasedifference Δφ on the basis of the cyclic delay between the signalstransmitted by antennas 34, as described in the above-mentioned U.S.Pat. No. 9,814,051. Alternatively, processor 39 may detect and make useof other features of the signals received from antennas 34 in findingthe phase difference.

FIG. 3 is a schematic, pictorial illustration of components of thesystem of FIG. 1, illustrating a method for finding the position ofmobile station 30, in accordance with an embodiment of the invention.This method assumes that the respective location coordinates (labeledx_(i),y_(i)) and BSSIDs of access points 22, 24 and 26 have already beenmapped by server 40, in a frame of reference indicated by the (X,Y) axesin the figure. The map also indicates a respective orientation angle(ϕ_(i)) for each access point, in this case the direction of a normal tothe axis of the antenna array of each access point. The method of FIG. 3uses angles of departure in a two-dimensional frame of reference(assuming the access points and mobile station to be in proximity to acommon plane, as explained above). Alternatively, this method may beextended to three dimensions, mutatis mutandis.

In some embodiments, the map is constructed on the basis of measurementsof angle of departure that were made previously by other mobile stationsand/or other input data. The mobile stations in this case report theirlocations and the estimated angles of departure to server 40, along withrespective identifiers of the access points, and the server constructsthe map accordingly. Server 40 can build this access point map withoutrequiring any cooperation by operators of the access points.Alternatively or additionally, the map may incorporate informationprovided by network operators and/or physical measurements made usingdedicated equipment.

In the embodiment of FIG. 3, mobile station 30 receives multi-antennasignals from each of access points 22, 24 and 26. As noted earlier,mobile station 30 may initiate an RTS/CTS exchange with one or more ofthe access points in order to induce the access points to transmit suchsignals. The mobile station extracts the respective angle of departure(AoD) for each access point, labeled θ₁, θ₂, and θ₃ in the figure, usingthe techniques described herein, along with the respective BSSIDs.Mobile station 30 reports these findings via network 38 (FIG. 1) toserver 40, which returns corresponding location coordinates. The servermay return the location coordinates and orientation angles of the accesspoints (x_(i),y_(i),ϕ_(i)), in which case mobile station 30 cantriangulate its own position (x_(s),y_(s)) based on these coordinatesand the measured angles of departure. Alternatively or additionally,mobile station 30 conveys the values of the angles of departure that ithas estimated to server 40, which then computes and returns the locationcoordinates to mobile station 30.

The location coordinates of mobile station 30 are computed by a processof triangulation: The measurements of angles of departure define raysextending from the respective location coordinates (x_(i),y_(i)) of theaccess points, in the fixed frame of reference of the map, at anglesα_(i). These angles are defined by the expression ϕ_(i)=θ_(i)+α_(i), asgiven by the respective orientation angle (ϕ_(i)) and the measured angleof departure (θ_(i)) from each of the access points. The locationcoordinates (x_(s),y_(s)) of mobile station 30 correspond to anintersection of these rays, as shown in FIG. 3.

Additionally or alternatively, mobile station 30 may process thereceived CTS frames in order to estimate other properties of the mobilestation, such as location, speed, or periodic variations, withoutnecessarily relying on the AoD computations described above. In someembodiments, these properties are estimated on the basis of channelstate information (CSI) that mobile station 30 extracts from thereceived CTS frames. The CSI in multi-carrier communications can berepresented as a vector of complex values, wherein each value representsthe respective signal propagation properties of one of the carrierfrequencies from a given transmitting antenna 34 to antenna 36 of mobilestation 30. The CSI values are typically computed by comparing thesignals in a certain part of the preamble of a frame received by mobilestation 30 to the expected data symbols in the preamble, as is known inthe art. The CSI with respect to any given access points 22, 24, 26varies with the location of mobile station 30 and thus represents a sortof location signature.

In one embodiment, the CSI values for signals received from accesspoints 22, 24, 26 may be measured and mapped over an area covered by theaccess points. This mapping may then be used in finding the location ofmobile station 30, by extracting the current CSI values from the signalsreceived by the mobile station and comparing them to the mapped values.This sort of location estimation can also be used for purposes ofgeo-fencing.

In addition, the changes in the extracted CSI values over time can beused to estimate the velocity of mobile station 30. Additionally oralternatively, if the mobile station is moving at a sufficient speed togive rise to an appreciable Doppler effect, the resulting variation inthe frequencies of the received signals will be reflected by the CSI andcan be used to find the velocity. Furthermore, periodic variations inthe CSI over time can be indicative of periodic changes in theenvironment of mobile station 30, such as periodic motion of a body orobject to which the mobile station is attached. Measurement of theperiodic changes can be used, for example, in monitoring respiration ofa person when a mobile station is held firmly against the person'sthorax.

When the present techniques are to be used in monitoring the locationand/or velocity of mobile station 30, the mobile station will typicallytransmit a sequence of RTS frames as it moves in order to receivemultiple, successive CTS frames in response, and thus to make successiveestimates of CSI and/or AoD. In one embodiment, mobile station 30 setsthe rate of repetition of the RTS frames in response to the speed ofmotion of the mobile station, as indicated, for example, by an inertialmeasurement unit (IMU) in the mobile station or by the CSI-basedvelocity measurements. When mobile station 30 is stationary, it willrefrain from transmitting RTS frames (or will transmit them onlyoccasionally) in order to conserve power and reduce network congestion.As the speed of the mobile station increases, it will increase the rateof RTS transmissions.

Upon receiving the RTS frames from mobile station 30, other stations inthe vicinity will refrain from transmission for a certain period; butthese other stations will also receive the CTS frames sent in responseto the RTS frames and will be able to process the CTS frames in order toextract their own readings of CSI and/or AoD.

INDUCING MULTI-ANTENNA TRANSMISSIONS BY ACCESS POINTS

FIG. 4 is a flow chart that schematically illustrates a method foranonymous collection of directional transmissions, in accordance with anembodiment of the invention. The method is described hereinbelow, forthe sake of concreteness and clarity, with reference to the elements ofsystem 20, and specifically to finding the locations of mobile stationsusing AoD, as shown in the preceding figures and described above.Alternatively or additionally, this method may be used in extracting CSIand computing values of properties of mobile stations based on the CSI,as was likewise explained above.

Alternatively, the principles of this method may be applied, mutatismutandis, in estimating angles of transmission among stations in othersorts of networks that support RTS/CTS functionality. The networks mayoperate in accordance with protocols in the IEEE 802.11 family, or inaccordance with other wireless protocols that support RTS/CTS or anequivalent method for clear channel assessment. The stationsimplementing the method may be either mobile or stationary. For example,stationary stations may apply the present method in finding locations ofmobile stations.

In the present example, mobile station 28 receives beacons from accesspoints 22, 24, 26, . . . , at a beacon reception step 50. Each beaconcontains a MAC address in the form of the BSSID of the access pointtransmitting the beacon. Some of the beacons may be transmitted asmulti-antenna OFDM signals; and in such cases mobile station 28 will beable to derive the angle of departure without resorting to an RTS/CTSexchange. In the present example, however, it is assumed that one ormore of the beacons are transmitted as omnidirectional, single-carriersignals, such as CCK signals in the 2.4 GHz band for compatibility withIEEE 802.11b.

Mobile station 28 selects an access point that transmitted anomnidirectional beacon, for example access point 22, and transmits anRTS frame to the selected access point, at an RTS transmission step 52.The mobile station transmits the RTS frame using a suitable OFDM scheme.The mobile station sets the RA of the RTS frame to be the BSSID ofaccess point 22, as indicated by the beacon received from the accesspoint. The mobile station may insert its own MAC address as the TA inthe RTS frame; but in the present embodiment, the mobile station setsthe TA to a spoofed value that uniquely encodes the BSSID of accesspoint 22. For example, mobile station 28 may compute an XOR between theBSSID and a predefined seed of the same, standard length as the BSSID.The result will be a value unique to access point 22, having the length(in bits) of a valid TA.

Upon receiving this RTS frame, access point 22 will respond bytransmitting a CTS frame, with the TA of the RTS frame inserted as theRA of the CTS frame. Access point 22 will transmit the CTS frame as amulti-antenna signal, in the same band and using the same modulationscheme as the RTS frame, i.e., using OFDM. Mobile station 28 receivesthe CTS frame, at a CTS reception step 54. Assuming the TA of the RTSframe was spoofed so as to encode the BSSID of access point 22, themobile station can now decode the RA of the CTS frame in order torecover the BSSID of the access point (for example, by computing an XORof the RA with the same seed as was used previously for encoding).Mobile station 28 measures the phase delay between the respectivesignals transmitted from antennas 34 in the CTS frame from access point22, and thus estimates the angle of departure from the access point, atan angle extraction step 56. Additionally or alternatively, mobilestation 28 processes the signals received form antennas 34 to extractCSI and computes values of properties such as the location and/orvelocity of the mobile station based on the extracted CSI.

The use of the spoofed TA in steps 52 and 54 is advantageous, interalia, in that it logically identifies the access point transmitting theCTS frame even though the address of the access point is not explicitlyembedded in the CTS frame. This approach enables mobile station 28 toimplement the present method as a stateless process, without having tokeep track of the status of each RTS/CTS exchange that it has initiated.It also enables the mobile station to collect angles of departure and/orCSI of multiple access points quickly in rapid succession, thus reducingpower consumption and freeing the resources of transceiver 37 (FIG. 1)for other communication tasks. Furthermore, assuming other mobilestations, such as mobile station 30, use the same location-findingapplication with the same seed, these other mobile stations will also beable to receive and decode the CTS frame transmitted by access point 22,and thus to find their own angles of departures and/or CSI relative tothe access point. (As noted earlier, upon detecting the RTS frametransmitted at step 52, these other mobile stations will refrain fromsending their own RTS frames to avoid clogging the channel.)

After receiving the CTS frame, mobile station 28 will typically nottransmit further data frames to access point 22 for at least 100 ms, butrather will devote its resources to location-finding and other tasks, ata non-transmission step 58. Mobile station 28 checks (or asks server 40to check) whether it has collected a sufficient number of measurementsof angles of departure in order to find the location of the mobilestation, at a sufficiency checking step 60. (Mobile station 28 mayreceive OFDM signals from various access points in both the 2.4 GHz andthe 5 GHz bands, and may measure angles of departure of signals in bothbands.) If the number of measurements is not yet sufficient, the processof FIG. 4 returns to step 50, in order to receive beacons and initiateRTS/CTS exchanges with other access points. Once a sufficient number ofmeasurements has been collected, mobile station 28 (or server 40)combines the angular measurements, together with the known locations ofthe stationary access points, in calculating the location coordinates ofthe mobile station, at a location calculation step 62. Additionally oralternatively, mobile station 28 (or server 40) may use the extractedCSI data in finding location, velocity, and/or other properties.

It will be appreciated that the embodiments described above are cited byway of example, and that the present invention is not limited to whathas been particularly shown and described hereinabove. Rather, the scopeof the present invention includes both combinations and subcombinationsof the various features described hereinabove, as well as variations andmodifications thereof which would occur to persons skilled in the artupon reading the foregoing description and which are not disclosed inthe prior art.

1. A method for communication, comprising: detecting, at a first stationin a wireless network, a beacon transmitted over the wireless network bya second station having multiple antennas; in response to the beacon,transmitting a request-to-send (RTS) frame over the wireless networkusing a multi-carrier modulation scheme from the first station to thesecond station; receiving at the first station a clear-to-send (CTS)frame transmitted over the wireless network, in response to the RTSframe, by the second station via the multiple antennas using themulti-carrier modulation scheme; and estimating a property of the firststation based on the received CTS frame.
 2. The method according toclaim 1, wherein detecting the beacon comprises identifying, at thefirst station, a signal transmitted by the second station using asingle-carrier modulation scheme as the beacon.
 3. The method accordingto claim 2, wherein the single-carrier modulation scheme is acomplementary code keying (CCK) scheme, while the multi-carriermodulation scheme is an orthogonal frequency-division multiplexing(OFDM) scheme.
 4. The method according to claim 1, wherein detecting thebeacon comprises extracting a medium access control (MAC) address of thesecond station from the beacon, and wherein transmitting the RTS framecomprises inserting the MAC address as a receiver address (RA) in theRTS frame.
 5. The method according to claim 4, wherein transmitting theRTS frame comprises generating a spoofed address that encodes the MACaddress of the second station, and inserting the spoofed address as atransmitter address (TA) in the RTS frame, thereby causing the secondstation to insert the spoofed address as the RA in the CTS frame.
 6. Themethod according to claim 5, wherein receiving the CTS frame comprisesdecoding the RA of the CTS frame in order to identify the second stationas having transmitted the CTS frame.
 7. The method according to claim 4,wherein the second station comprises an access point (AP) in thewireless network, and the MAC address of the second station comprises abasic service set identifier (BSSID) of the AP.
 8. The method accordingto claim 1, wherein after receiving the CTS frame, the first stationdoes not transmit further frames to the second station for at least 100ms.
 9. The method according to claim 1, wherein the first station is amobile station in a wireless local area network (WLAN), and the secondstation is a stationary access point (AP) in the WLAN.
 10. The methodaccording to claim 9, wherein transmitting the RTS frame and receivingthe CTS frame comprise transmitting and receiving the RTS and CTS framesto and from the AP without establishing an association between themobile station and the AP.
 11. The method according to claim 1, andcomprising receiving the CTS frame from the second station at a thirdstation, which did not transmit the RTS frame, and estimating a furtherproperty of the third station based on the CTS frame received at thethird station.
 12. The method according to claim 1, wherein estimatingthe property comprises processing the received CTS frame to extractchannel state information (CSI), and computing a value of the propertyof the first station using the extracted CSI.
 13. The method accordingto claim 12, wherein computing the value comprises finding a location ofthe first station.
 14. The method according to claim 12, whereincomputing the value comprises finding a velocity of the first station.15. The method according to claim 12, wherein computing the valuecomprises detecting a periodic variation in the CSI, and applying theperiodic variation in assessing periodic changes in an environment ofthe first station.
 16. The method according to claim 1, whereintransmitting the RTS frame comprises transmitting a sequence of RTSframes in response to a motion of the first station.
 17. The methodaccording to claim 13, wherein transmitting the sequence comprisessetting a rate of repetition of the RTS frames responsively to a speedof the motion.
 18. Apparatus for communication, comprising: atransceiver, which is configured to detect a beacon transmitted over awireless network by a station having multiple antennas; and a processor,which is configured to drive the transceiver, in response to the beacon,to transmit a request-to-send (RTS) frame over the wireless networkusing a multi-carrier modulation scheme to the station, and to process aclear-to-send (CTS) frame transmitted over the wireless network, inresponse to the RTS frame, by the station via the multiple antennasusing the multi-carrier modulation scheme and received by thetransceiver, in order to estimate a property of the apparatus.
 19. Theapparatus according to claim 18, wherein the detected beacon comprises asignal transmitted by the second station using a single-carriermodulation scheme.
 20. The apparatus according to claim 19, wherein thesingle-carrier modulation scheme is a complementary code keying (CCK)scheme, while the multi-carrier modulation scheme is an orthogonalfrequency-division multiplexing (OFDM) scheme.
 21. The apparatusaccording to claim 18, wherein the processor is configured to extract amedium access control (MAC) address of the station from the beacon, andto insert the MAC address as a receiver address (RA) in the RTS frame.22. The apparatus according to claim 21, wherein the processor isconfigured to generate a spoofed address that encodes the MAC address ofthe station, and to insert the spoofed address as a transmitter address(TA) in the RTS frame, thereby causing the station to insert the spoofedaddress as the RA in the CTS frame.
 23. The apparatus according to claim22, wherein the processor is configured to decode the RA of the CTSframe in order to identify the station as having transmitted the CTSframe.
 24. The apparatus according to claim 21, wherein the stationcomprises an access point (AP) in the wireless network, and the MACaddress of the second station comprises a basic service set identifier(BSSID) of the AP.
 25. The apparatus according to claim 18, whereinafter receiving the CTS frame, the processor does not transmit furtherframes to the station for at least 100 ms.
 26. The apparatus accordingto claim 18, wherein the transceiver is configured for operation in amobile station in a wireless local area network (WLAN), and the stationis a stationary access point (AP) in the WLAN.
 27. The apparatusaccording to claim 26, wherein the mobile station is configured totransmit and receive the RTS and CTS frames to and from the AP withoutestablishing an association between the mobile station and the AP. 28.The apparatus according to claim 18, wherein the processor is configuredto process the received CTS frame to extract channel state information(CSI), and to compute a value of the property using the extracted CSI.29. The apparatus according to claim 28, wherein the value indicates alocation of the first station.
 30. The apparatus according to claim 28,wherein the value indicates a velocity of the first station.
 31. Theapparatus according to claim 28, wherein the processor is configured todetect a periodic variation in the CSI, and to apply the periodicvariation in assessing periodic changes in an environment of theapparatus.
 32. The apparatus according to claim 18, wherein thetransceiver is configured to transmit a sequence of RTS frames inresponse to a motion of the apparatus.
 33. The apparatus according toclaim 32, wherein the processor is configured to set a rate ofrepetition of the RTS frames responsively to a speed of the motion. 34.A computer software product, comprising a non-transitorycomputer-readable medium in which program instructions are stored, whichinstructions, when read by a processor, cause the processor to detect abeacon transmitted over a wireless network by a second station havingmultiple antennas and received by a first station, and to transmit fromthe first station, in response to the beacon, a request-to-send (RTS)frame over the wireless network using a multi-carrier modulation schemeto the second station, and to receive and process a clear-to-send (CTS)frame transmitted over the wireless network, in response to the RTSframe, via the multiple antennas using the multi-carrier modulationscheme in order to estimate a property of the first station.